What SOPs Does a Virtual Pharmaceutical Company Need?

If you're running a virtual pharmaceutical company, meaning a small team that outsources manufacturing, testing, and clinical work to CMOs, CROs, and labs, you've probably asked some version of this question: which SOPs do we actually need?

It's a fair question. Big pharma runs on hundreds of procedures. A three-person sponsor preparing its first IND doesn't need, and can't realistically maintain, anything close to that. But "we outsource everything" doesn't mean "we don't need procedures." As we covered in our post on virtual company responsibilities, FDA expects the sponsor to demonstrate control over the quality of its product, no matter who does the hands-on work.

Here is how we think about building a right-sized SOP set for a virtual sponsor, based on our decades of writing, reviewing, and negotiating quality documents with sponsors and manufacturers.

Why a virtual company needs SOPs at all

You can outsource tasks. You cannot outsource responsibility. A few examples of where that shows up:

  • 21 CFR 211.22 requires a quality control unit with written responsibilities and procedures. For a virtual sponsor, that "unit" may be one person, but the responsibilities still have to be defined and followed.
  • FDA's Quality Agreements guidance (2016) makes clear that the owner of the product remains responsible for its quality, even when a contract facility makes it.
  • FDA's guidance on CGMP for Phase 1 investigational drugs relaxes many Part 211 requirements for early clinical supplies, but it still expects written procedures, a quality control function, and records that show what was done.
  • Your partners will ask. Investors, licensing partners, and acquirers routinely request your SOP index during due diligence. A thin or missing quality system can slow a deal or lower a valuation.

Just as important: once you have SOPs, inspectors and auditors will hold you to them. A procedure you wrote but don't follow is often a bigger problem than a procedure you never wrote. That's why a virtual company's SOPs need to be written for a virtual company.

Tier 1: The foundation (have these before your first GMP batch)

These documents define how your quality system works. Almost every other procedure depends on them.

  1. Quality Policy or Quality Manual. The top-level document that describes your quality management system, who is responsible for what, and which GxP areas (GMP, GCP, GLP, GDP, GVP) apply to your program. See our Quality Policy template.
  2. SOP on SOPs (document control). How procedures, policies, and forms are written, numbered, reviewed, approved, revised, and retired. Without this, your document system drifts quickly. See our SOP on SOPs.
  3. Training. How you document that employees, contractors, and consultants are trained on the procedures that apply to them. Training records are one of the first things an auditor asks for. Our Training SOP is free to download.
  4. Good Documentation Practices (GDP). The rules for recording, correcting, signing, and dating GxP records. See our Good Documentation Practices SOP.
  5. Data Integrity and Record Retention. How you apply ALCOA+ principles and how long you keep records. Retention periods differ across GxP areas, so this policy prevents records from being destroyed too early. See our Data Integrity Policy.

Tier 2: Controlling your outsourced work

This is where virtual sponsors most often fall short, and where FDA and partners look hardest. When your CMO or lab is doing the work, these procedures are how you show you are in control of it.

  1. Vendor qualification and management. How you select, approve, classify, and periodically re-evaluate GMP vendors. See our Vendor Management SOP.
  2. Vendor audits. How you plan, conduct (on-site or remotely), report, and close out audits of your CMOs, labs, and other critical suppliers. See our Vendor Audits SOP.
  3. Quality agreements. How you negotiate, approve, and maintain quality agreements, and what belongs in them. This is the document that spells out who does what between you and each vendor. See our Quality Agreements SOP.
  4. Batch review and release. How your company reviews executed batch records, certificates of analysis, and deviations before a batch is released, and when a lighter, risk-based review is appropriate. See our Batch Review and Release SOP.

Tier 3: Add these as your program grows

Depending on your phase, product, and how much your vendors handle for you, you will likely need procedures covering some or all of the following:

  • Deviations and investigations
  • Corrective and preventive action (CAPA)
  • Change control
  • Complaints and product quality issues
  • Clinical supply labeling, distribution, and returns
  • CRO oversight and the Trial Master File (GCP)
  • Safety reporting and pharmacovigilance (GVP)
  • Stability program oversight
  • Management review of the quality system

Some of these can be handled by your vendors' procedures, as long as your quality agreements say so clearly and you have a way to review what they do. The key is making a deliberate decision, not leaving a gap by accident.

Common mistakes we see

  • Copying big pharma SOPs. They reference departments, committees, and systems a virtual company doesn't have. The result is procedures nobody can follow.
  • Writing SOPs and never training on them. An SOP without training records is hard to defend in an audit.
  • Relying entirely on the CMO's quality system. Their procedures protect their business. Yours need to protect your product and your program.
  • Forgetting periodic review. Procedures written for Phase 1 often don't fit Phase 2 or 3. Build in a review cycle so they grow with you.

Where to start

If you're starting from zero, begin with Tier 1 and the quality agreement and vendor management procedures from Tier 2. That core set gives you a defensible quality system for most early-stage virtual sponsors, and a solid base to build on.

Want to see what a right-sized SOP looks like? Download our free Training SOP to see the format and depth of every QualitySOPs template, or browse the full catalog of GxP SOP templates.

This article is general information, not regulatory or legal advice. Requirements depend on your product, phase, and the regions where you operate.

Back to blog